ISO 27001 ISMS Audit Forcing Questions — Security & Safety

This skill runs a six-question forcing interrogation to pressure-test ISO 27001 ISMS audit readiness. It checks audit scope and 3-year coverage, risk register health, access reviews, supplier management, incident response, and management review, producing a structured readiness report with a verdict and top actions.

compliance-os claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Checks rolling 3-year audit coverage and auditor independence
Verifies risk register freshness and linkage of high/critical risks to Annex A controls
Reviews access control records (A.5.15, A.8.2, A.8.3) including termination deprovisioning evidence
Assesses supplier inventory and review evidence (A.5.19-A.5.21) including DPAs and AI clauses
Evaluates incident response evidence and post-incident reviews (A.5.24-27, A.6.8)
Confirms management review cadence and presence of Clause 9.3 required inputs

🎯 When to use it

Before an annual Clause 9.2 internal audit
Before stage 1 or stage 2 ISO 27001 certification audit
Before a surveillance audit (year 2 or year 3)
After a material change to ISMS scope (e.g., new business unit, new SaaS adoption)
Post-incident or during high-growth phases for ad-hoc audit readiness

🚀 How to use

Trigger: /cs:iso27001-audit-prep

Trigger with the slash command /cs:iso27001-audit-prep <scope>, providing the audit scope (e.g., a business unit or product line). The skill runs a structured interrogation covering six key areas and outputs a readiness report. Example prompts:

/cs:iso27001-audit-prep core-platform

Run ISO 27001 audit prep for our new SaaS product line.

📄 Output: A markdown readiness report with audit programme status, risk register health, high-stakes controls status, management review status, cross-framework impact, a verdict (READY/CLOSE-CRITICALS-FIRST/NOT-READY), and top 3 actions.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/compliance-os/skills/iso27001-audit-prep .claude/skills/iso27001-audit-prep

Skill source: compliance-os/skills/iso27001-audit-prep/SKILL.md

⚠️ Good to know

Requires access to real audit records (e.g., Okta/IAM logs, supplier reviews, incident reports) and the referenced scripts and playbooks; does not replace actual audit evidence collection.

❓ FAQ

How often should the risk register be refreshed?

The skill expects a quarterly refresh, with an annual minimum, and every high/critical risk must link to at least one Annex A control.

What is the most-cited finding area?

Access review records are the most-cited finding area, requiring quarterly cadence and evidence of deprovisioning for terminated employees within 24 hours.

What does the verdict indicate?

The verdict is one of READY, CLOSE-CRITICALS-FIRST, or NOT-READY, summarizing overall audit readiness based on the six questions.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.